84 lines
2.2 KiB
JavaScript
84 lines
2.2 KiB
JavaScript
import express from "express";
|
|
import bcrypt from "bcryptjs";
|
|
import jwt from "jsonwebtoken";
|
|
import Staff from "../models/Staff.model.js";
|
|
import { protectStaff, logoutStaff } from "../middleware/staffAuthMiddleware.js";
|
|
|
|
const router = express.Router();
|
|
|
|
/**
|
|
* 📌 Staff Login - Store JWT in Database
|
|
*/
|
|
router.post("/login", async (req, res) => {
|
|
const { username, password } = req.body;
|
|
|
|
try {
|
|
const staff = await Staff.findOne({ username });
|
|
if (!staff) {
|
|
return res.status(401).json({ error: "Staff user not found" });
|
|
}
|
|
|
|
const isMatch = await bcrypt.compare(password, staff.passwordHash);
|
|
if (!isMatch) {
|
|
return res.status(401).json({ error: "Invalid credentials" });
|
|
}
|
|
|
|
// Generate JWT for Staff/Admin
|
|
const token = jwt.sign(
|
|
{ id: staff._id, role: staff.role },
|
|
process.env.JWT_SECRET,
|
|
{ expiresIn: "7d" }
|
|
);
|
|
|
|
// Store token in database
|
|
staff.currentToken = token;
|
|
await staff.save();
|
|
|
|
res.json({ token, role: staff.role });
|
|
} catch (error) {
|
|
res.status(500).json({ error: error.message });
|
|
}
|
|
});
|
|
|
|
/**
|
|
* 📌 Staff Logout - Remove JWT from Database
|
|
*/
|
|
router.post("/logout", protectStaff, logoutStaff);
|
|
|
|
/**
|
|
* 📌 Force Logout All Staff Users (Admin Only)
|
|
*/
|
|
router.post("/logout/all", protectStaff, async (req, res) => {
|
|
try {
|
|
if (req.user.role !== "admin") {
|
|
return res.status(403).json({ error: "Access restricted to admins only" });
|
|
}
|
|
|
|
await Staff.updateMany({}, { currentToken: null });
|
|
|
|
res.json({ message: "All staff users have been logged out" });
|
|
} catch (error) {
|
|
res.status(500).json({ error: "Failed to log out all staff users" });
|
|
}
|
|
});
|
|
|
|
/**
|
|
* 📌 Check Staff Sessions (Admin Only)
|
|
*/
|
|
router.get("/sessions", protectStaff, async (req, res) => {
|
|
try {
|
|
if (req.user.role !== "admin") {
|
|
return res.status(403).json({ error: "Access restricted to admins only" });
|
|
}
|
|
|
|
const activeSessions = await Staff.find({ currentToken: { $ne: null } })
|
|
.select("username role currentToken createdAt");
|
|
|
|
res.json({ activeSessions });
|
|
} catch (error) {
|
|
res.status(500).json({ error: "Failed to fetch active sessions" });
|
|
}
|
|
});
|
|
|
|
|
|
export default router; |